Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

Search CVE reports

Toggle filters

1 – 5 of 5 results

CVE-2022-45868

Low priority
Ignored

** DISPUTED ** The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console....

3 affected packages

h2database, jameica-h2database, mediathekview

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
h2database Not affected Not affected Not affected Not affected Not affected
jameica-h2database Not affected Not in release Not in release Not in release Ignored
mediathekview Not affected Not affected Not affected Not affected Not affected
Show less packages

CVE-2022-23221

Medium priority

Some fixes available 5 of 8

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than...

1 affected packages

h2database

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
h2database Not affected Fixed Fixed Fixed Fixed
Show less packages

CVE-2021-42392

High priority

Some fixes available 5 of 8

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers,...

1 affected packages

h2database

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
h2database Not affected Fixed Fixed Fixed Fixed
Show less packages

CVE-2021-23463

Medium priority
Ignored

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from...

1 affected packages

h2database

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
h2database Not affected Not affected Not affected Not affected Not affected
Show less packages

CVE-2018-14335

Medium priority
Vulnerable

An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.

1 affected packages

h2database

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
h2database Not affected Not affected Vulnerable Vulnerable Vulnerable
Show less packages